ShipworkSite inspection
Checks
Every error, explainedGuides →
Pricing Learn Guides

Are the files other systems expect actually there?

Some dependencies are not pages at all. ads.txt gates programmatic ad revenue. security.txt gives a researcher somewhere to send a vulnerability. sellers.json declares who sells your inventory. Their absence is a business problem, not a technicality.

Runs the free audit, which includes this check where it applies to your site. Nothing is stored.

What this check inspects

Shipwork requests /ads.txt, /app-ads.txt, /security.txt, /.well-known/security.txt, /sellers.json and /humans.txt, with a total time budget so a slow host cannot hold the request open. For ads.txt it also parses the lines and counts how many are malformed, since each line needs a domain, a publisher id and a relationship.

What a failure means

A missing ads.txt is a warning: if you sell programmatic ads, unauthorised resellers can sell your inventory and you may not be paid for it. An empty ads.txt is a warning for the same reason. Malformed lines are a warning because they are ignored. A missing security.txt is informational.

How to fix it

  1. If you sell programmatic inventory, publish a valid ads.txt with one line per authorised seller.
  2. Check every ads.txt line has exactly the three fields it needs, in the right order.
  3. Publish security.txt, at the root or under /.well-known, with a contact and an expiry.
  4. Keep sellers.json in step with who is actually allowed to sell your inventory.

A typical failure, worked through

The setupA publisher adds ads.txt by copying a partner file, but one line is missing the relationship field.

What the check reportsThe check reports ads.txt present, then reports that one of the lines is malformed. That line is ignored, so the seller it was meant to authorise is not authorised.

The pointA present-but-wrong file produces no error anywhere. Only parsing it reveals that a line does nothing.

Questions

Does every site need ads.txt?
No. Only sites that sell programmatic advertising inventory. A store that does not run ads can ignore it.
What should security.txt contain?
At least a contact method and an expiry date, so a researcher who finds a vulnerability knows who to tell and until when the file is valid.
Why is sellers.json separate from ads.txt?
ads.txt says who may sell your inventory. sellers.json says who the sellers in a bid request actually are. Together they let buyers verify the chain.

Related checks and guides